---
typeId: req
recordId: benac-stor-009
fields:
  title: Client-side encryption for private remote storage
  statement: Private blobs shall be encrypted before remote storage unless local
    policy explicitly treats the Storage Station as a trusted processor and
    records the resulting disclosure.
  rationale: Storage Stations generally need not receive plaintext.
  verification: Private blob remote put stores ciphertext unless explicit
    processor disclosure path is approved.
  testable: true
  status: draft
  area: BENAC-STOR
  sourceDocument: /home/johnb/Downloads/benac_syrs_v0_4_integrated_authentication.md
  sourceVersion: v0.4
  sourceSections:
    - 10.11 Storage discovery, remote storage, and content availability
  order: 126
---
